diff --git a/README.md b/README.md
index bec8a51..f6686fa 100644
--- a/README.md
+++ b/README.md
@@ -109,15 +109,24 @@ The helper supports the following custom attributes:
 
 - `@bearer-token`: Bearer token for `Authorization` header
 - `@header`: Custom HTTP headers (can be specified multiple times)
+- `@use-netrc`: Enable [netrc](https://everything.curl.dev/usingcurl/netrc.html) authentication
+- `@netrc-file`: Path to custom [netrc](https://everything.curl.dev/usingcurl/netrc.html) file (implies `@use-netrc`)
 - `@layout`: Storage layout mode
   - `subdirs` (default): First 2 hex chars as subdirectory
   - `flat`: All files in root directory
   - `bazel`: Bazel Remote Execution API compatible layout
 
-Example:
+Examples:
 
 ```bash
+# Custom header
 export CCACHE_REMOTE_STORAGE="https://cache.example.com @header=Content-Type=application/octet-stream"
+
+# Using netrc authentication (reads from ~/.netrc). @use-netrc is equal @use-netrc=true
+export CCACHE_REMOTE_STORAGE="https://cache.example.com @use-netrc"
+
+# Using custom netrc file
+export CCACHE_REMOTE_STORAGE="https://cache.example.com @netrc-file=/path/to/my-netrc"
 ```
 
 ## Optional debug logging
diff --git a/src/config.cpp b/src/config.cpp
index 12b43a3..01c98f7 100644
--- a/src/config.cpp
+++ b/src/config.cpp
@@ -104,6 +104,11 @@ std::optional<Config> parse_config()
         std::string header_value = value_str.substr(eq_pos + 1);
         config.headers.emplace_back(header_name, header_value);
       }
+    } else if (key_str == "use-netrc") {
+      config.use_netrc = (value_str == "true");
+    } else if (key_str == "netrc-file") {
+      config.use_netrc = true;
+      config.netrc_file = value_str;
     }
   }
 
diff --git a/src/config.hpp b/src/config.hpp
index 039d7e2..d8d1163 100644
--- a/src/config.hpp
+++ b/src/config.hpp
@@ -29,6 +29,8 @@ struct Config
   std::optional<std::string> bearer_token;
   UrlLayout layout = UrlLayout::SUBDIRS;
   std::vector<std::pair<std::string, std::string>> headers;
+  bool use_netrc = false;
+  std::optional<std::string> netrc_file;
 };
 
 std::optional<Config> parse_config();
diff --git a/src/storage_client.cpp b/src/storage_client.cpp
index 5fd953c..0776976 100644
--- a/src/storage_client.cpp
+++ b/src/storage_client.cpp
@@ -229,6 +229,13 @@ CURL* StorageClient::create_easy_handle(HttpRequest* request)
   curl_easy_setopt(handle, CURLOPT_WRITEDATA, request);
   curl_easy_setopt(handle, CURLOPT_WRITEFUNCTION, write_callback);
 
+  if (_config.use_netrc) {
+    curl_easy_setopt(handle, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
+    if (_config.netrc_file) {
+      curl_easy_setopt(handle, CURLOPT_NETRC_FILE, _config.netrc_file->c_str());
+    }
+  }
+
   curl_slist* headers = nullptr;
 
   if (_config.bearer_token) {